The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes video transcripts from external sources, which presents a surface for indirect instructions to influence agent behavior.
Ingestion points: The video transcribe functionality in scripts/postey.js fetches external video content and uses Whisper to generate transcripts.
Boundary markers: The prompts defined in prompts.md use clear delimiters (e.g., Transcript: {{transcript}}) to scope external data.
Capability inventory: The skill has the ability to create, update, and schedule social media posts through tools like create_post and schedule_post.
Sanitization: The references/caption-playbook.md provides explicit guidelines for the agent to treat source material as a seed rather than a script, and the CLI script redacts potential credentials from subprocess output.
[COMMAND_EXECUTION]: The skill's CLI script executes local binaries to perform media processing tasks.
Evidence: The scripts/postey.js and scripts/videoUtils.js scripts spawn ffmpeg, ffprobe, yt-dlp, and whisper to handle video trimming, metadata extraction, and transcription.
Security Controls: The script includes an assertPublicHttpUrl check to prevent SSRF by blocking loopback and private network addresses. It also uses a redactUrls function to strip query parameters from URLs in log outputs and ensures sensitive environment variables like POSTEY_API_KEY are removed before spawning subprocesses.
[EXTERNAL_DOWNLOADS]: The skill references and fetches resources from the vendor's official repository.
Evidence: The bootstrap-prompt.md and pack.json files describe fetching skill manifests and playbooks from the Postey organization's GitHub repository (raw.githubusercontent.com/posteyai/skills).

postey